AI changed the patching race

AI is finding vulnerabilities faster than organizations are fixing them.

Anthropic’s Project Glasswing results show the scale of this shift.

Using Claude Mythos Preview, Anthropic and approximately 50 initial partners found more than 10,000 high or critical-severity vulnerabilities in one month.

Founding participants include Cisco, CrowdStrike, Google, NVIDIA, and Palo Alto Networks, alongside other technology and critical-infrastructure leaders.

The results include:

• Mozilla found and fixed 271 vulnerabilities in Firefox 150, more than ten times the number found using Claude Opus 4.6 in Firefox 148.
• Anthropic scanned more than 1,000 open-source projects and identified 23,019 potential vulnerabilities.
• Independent security firms validated 90.6% of the 1,752 high or critical findings reviewed.

Project Glasswing has since expanded to approximately 150 additional organizations across more than 15 countries.

The broader threat data adds urgency:

• Cisco reports the median enterprise patch cycle is approximately 20 days, while the exploit window has fallen to roughly 20 hours.
• CrowdStrike reported an 89% year-over-year increase in attacks involving AI-enabled adversaries.
• Palo Alto reports that the fastest AI-assisted attacks are already moving from access to exfiltration in 25 minutes.

The security bottleneck is moving to:

• Validating findings
• Prioritizing business risk
• Coordinating responsible disclosure
• Developing and testing patches
• Deploying fixes across complex environments
• Verifying remediation

Anthropic reports an average high or critical vulnerability takes two weeks to patch.

AI-assisted attackers will not operate on the same schedule.

Security leaders need to rethink processes designed around human discovery speed. Vulnerability management, secure development, patch automation, and compensating controls must operate as one continuous system.

Mythos gives defenders a head start.

Project Glasswing shows why collaboration among companies such as Cisco, CrowdStrike, Google, NVIDIA, and Palo Alto Networks matters.

The long-term advantage will belong to organizations moving from discovery to verified remediation at machine speed.

We must fight AI with AI.

Is your security operating model prepared for thousands of new vulnerabilities discovered in weeks instead of years?